This article is a practical legal guide for individuals and businesses in the Philippines. It explains the relevant laws, common scam patterns, how to preserve evidence, and how to report to the National Bureau of Investigation (NBI), Philippine National Police–Anti-Cybercrime Group (PNP-ACG), Securities and Exchange Commission (SEC), and Bangko Sentral ng Pilipinas (BSP). It also covers related regulators you may need to contact. This is general information, not legal advice.

I. Core Legal Framework

Revised Penal Code (RPC)
- Estafa/Swindling (Art. 315 et seq.) — fraud through false pretenses, abuse of confidence, or fraudulent means (including online).
- Qualified theft (Art. 310) — unlawful taking by those with access (e.g., employees).
- Falsification (Arts. 171–172) — forged signatures, fabricated documents/screenshots that pass as public or private documents.
Cybercrime Prevention Act of 2012 (Republic Act No. 10175)
- Penalizes computer-related fraud, illegal access, data interference, identity theft, and aiding/abetting cybercrimes.
- Allows real-time collection and preservation of computer data upon proper legal process and coordination with law enforcement.
Electronic Commerce Act of 2000 (RA 8792)
- Recognizes electronic documents and electronic signatures as legally valid, relevant to proving online transactions.
Financial Consumer Protection Act of 2022 (RA 11765)
- Empowers BSP, SEC, Insurance Commission (IC), and Cooperative Development Authority (CDA) to adjudicate monetary claims within thresholds, issue compliance orders, and sanction supervised entities for abusive practices and unsafe conduct.
Anti-Money Laundering Act (RA 9160, as amended)
- AMLC may freeze or inquire into bank accounts upon proper grounds; suspicious transaction reporting may trigger mitigation or recovery efforts.
Data Privacy Act of 2012 (RA 10173)
- National Privacy Commission (NPC) handles phishing, doxxing, SIM-swap/data breaches, and unlawful processing of personal data.
SIM Registration Act (RA 11934)
- Assists in tracing SIM-enabled fraud; telcos may act on lawful requests to preserve or disclose data pursuant to due process.

II. How to Recognize Common Scams (With Legal Hooks)

Investment and “Trading Bot” Schemes
- Red flags: guaranteed returns, recruitment bonuses, unlicensed “brokers,” pressure to deposit via e-wallet/crypto.
- Likely violations: Securities Regulation Code (unregistered securities/salesmen), estafa, cyber-related fraud.
- Where to report: SEC (primary), NBI/PNP-ACG (criminal), BSP if banks/e-money are involved (consumer redress).
Online Marketplace Fraud
- Red flags: pay-first/no COD for high-value items, off-platform chats, fake waybills, “proof of shipment” screenshots only.
- Likely violations: estafa, falsification, D TI issues for deceptive sales practices.
- Where to report: NBI/PNP-ACG; DTI for consumer remedies; platform dispute mechanisms.
Phishing/Spoofing/Business Email Compromise (BEC)
- Red flags: look-alike domains, urgent fund transfer requests, changed beneficiary details, MFA prompts you didn’t initiate.
- Likely violations: computer-related fraud, identity theft (RA 10175), estafa.
- Where to report: NBI/PNP-ACG; notify banks/e-wallets immediately for transaction recall/hold; NPC for personal data compromise.
Loan App Harassment/Predatory Lending
- Red flags: unauthorized contact scraping, shaming, usurious rates, hidden fees.
- Likely violations: Data Privacy Act (unlawful processing), FCPA/BSP (unsafe conduct), SEC (for non-bank lending/financing companies).
- Where to report: SEC (lending/financing firms), BSP (if bank/e-money), NPC (privacy abuses), NBI/PNP-ACG (criminal).
Romance/“Pig-Butchering” and Crypto Swindles
- Red flags: quick intimacy, offshore exchanges, wallet transfer “taxes,” withdrawals blocked until new deposits.
- Likely violations: estafa, computer-related fraud, potential securities violations.
- Where to report: NBI/PNP-ACG; SEC (if investments offered); BSP (if payment rails used).
Job Offer/Work-From-Home Tasking
- Red flags: pay a “placement fee,” WhatsApp/Telegram only, “task recharges.”
- Likely violations: estafa, illegal recruitment (if mass hiring without license).
- Where to report: NBI/PNP-ACG; DOLE/POEA (if overseas recruitment angle).

III. Evidence: What to Capture and Preserve

Golden rule: Don’t delete, don’t edit, don’t forward—preserve original metadata where possible.

Screenshots: entire conversation threads showing dates, handles, and profile links; capture full page with URL and timestamp.
Raw files: PDFs, images, voice notes, videos, QR codes, invoices, contracts, terms, payment receipts.
Headers & logs: email headers, IP logs, login alerts, device IDs (from platforms), bank transaction logs, reference numbers.
Blockchain traces: wallet addresses, tx hashes, exchange tickers (no need for credentials).
Chain of custody notes: who collected what, when, and how; avoid altering files; store hash values if possible.
Witnesses and timeline: who can attest to chats/calls, when the demand/deposit/withdrawal occurred.

Tip: Make a read-only evidence folder (cloud or external drive). Keep a running timeline (date/time, event, amount, counter-party, proof).

IV. Immediate “First 24 Hours” Playbook

Stop transfers and revoke access (change passwords, remove devices, enable MFA).
Alert your bank/e-wallet and request a transaction recall/hold, account freeze, or trace as applicable.
Preserve evidence (see above) and note exact times and amounts.
Report promptly to the appropriate law-enforcement and regulator (see sections V–VIII). Speed improves chances of fund recovery.
If work devices/accounts are involved, notify your IT/SecOps to isolate and review endpoints.

V. Filing a Criminal Complaint with the NBI

Who they are: National investigative body with cybercrime units handling online fraud, identity theft, computer-related offenses, and complex financial crimes.

What to prepare:

Affidavit-Complaint (see template below) with a clear narrative of facts, legal basis (e.g., estafa, RA 10175), and reliefs sought.
Annexes: evidence list (numbered), KYC IDs, proof of authority (for companies), and contact information.
Optional: request for data preservation and coordination with banks/telcos/platforms.

Where/how to file:

Walk-in at NBI offices/Regional Operations or Cybercrime Division; or
Online intake (where available) for initial assessment before in-person execution of affidavits.
Expect evaluation, possible clarificatory conference, and forensic collection if warranted.

Outcome: If probable cause is found, NBI may pursue inquest or file a complaint with the Prosecutor’s Office, seek warrants/subpoenas, and coordinate with regulators and AMLC.

VI. Filing a Criminal Complaint with the PNP–Anti-Cybercrime Group (PNP-ACG)

Who they are: Specialized police group for cyber-enabled crimes (phishing, scams, BEC, online sales fraud, SIM-swap, social-media hijacks).

What to prepare: Same documentary set as for NBI. Bring devices only upon instruction (do not factory-reset).

Where/how to file:

ACG Headquarters and Regional Anti-Cybercrime Units (RACUs) accept reports.
You may receive guidance on entrapment, preservation letters, or coordination with banks/telcos.

Outcome: PNP-ACG may commence criminal investigation, apply for warrants, and file with prosecutors. You may pursue either NBI or PNP-ACG (you don’t need both), but avoid duplicate filings without disclosure—coordinate to keep a single case path when possible.

VII. Reporting Investment Scams to the SEC

Who they are: Regulates the offer/sale of securities, lending/financing companies, and investment solicitations.

When to report to SEC:

Offers of unregistered securities (e.g., fixed-income/ROI packages, tokens as investments).
Unlicensed brokers/agents soliciting funds.
Abusive lending/financing apps or entities (non-bank).

What to prepare:

Affidavit, screenshots/ads/receipts, identities/handles, bank accounts/wallets used.
Proof that the entity is not registered or not licensed (if you have it; otherwise SEC can verify).

Possible outcomes:

Advisories, cease-and-desist orders, asset freezes (through AMLC coordination), administrative fines, referrals for criminal prosecution, and restitution through administrative adjudication under FCPA thresholds.

VIII. Reporting Bank/E-Money/E-Payments Issues to the BSP

Who they are: Regulates banks, electronic money issuers (EMIs), payment system operators, and digital banks/e-wallets.

When to report to BSP:

Unauthorized transactions (account takeovers, SIM-swap fraud).
Poor complaint handling by a supervised institution.
Mis-selling, unsafe or unfair conduct (FCPA).

Standard escalation path:

Complain to the bank/e-wallet first using their official consumer assistance channels; obtain a case/reference number.
If unresolved or denied, elevate to BSP with: your affidavit/letter, transaction details, reference number, and supporting evidence.
BSP may direct corrective action, impose sanctions, or adjudicate eligible monetary claims against supervised entities (within statutory limits).

IX. Other Agencies You May Need

National Privacy Commission (NPC): for phishing/data breach, unlawful contact scraping, doxxing, and privacy harms.
Department of Trade and Industry (DTI): for consumer product/service deception and online selling issues.
Insurance Commission (IC): for insurance/HMO-related mis-selling or claim denials linked to scams.
Cooperative Development Authority (CDA): for cooperative-linked investment issues.
AMLC Secretariat: for freeze/flag actions via banks and covered persons; generally triggered through law-enforcement/regulator coordination.
DOLE/DMW (formerly POEA): for illegal recruitment.
DICT/Relevant Task Forces: for incident response and infrastructure-level coordination, as available.

X. Jurisdiction, Venue, and Prescriptive Periods (High-Level)

Venue (criminal): generally where any essential element of the offense occurred (e.g., where the victim was deceived, where money was deposited, or where the perpetrator operated). Cybercrime venue rules can extend to where the computer system is accessed or the data is produced.
Venue (civil): where the plaintiff or defendant resides or as stipulated.
Prescription: depends on the penalty attached to the offense; estafa’s period is tied to the amount/penalty band. If timing is tight, file promptly and consult counsel to avoid lapses.

XI. Civil and Administrative Remedies

Civil action for damages (moral, exemplary, actual) arising from quasi-delict or breach.
Rescission or annulment of contracts obtained through fraud.
Asset recovery through writs of attachment, AMLC freezes, and replevin (where appropriate).
Administrative adjudication under RA 11765 for qualifying monetary claims against supervised financial entities.

XII. Practical Drafting: Affidavit-Complaint (Template)

Title: Affidavit-Complaint for Estafa and Violation of RA 10175 Complainant: Name, age, civil status, address, government ID Respondents: Known names/aliases/handles, addresses (if known) Narrative of Facts:

On [date/time], I received [message/post] from [handle] offering [investment/product].

Respondents represented that [guaranteed returns/features]. I relied on such representations.

On [dates], I transferred a total of ₱[amount] to [accounts/wallets] with references [nos.].

Thereafter, [blocked/ghosted/changed wallet/withheld withdrawals].

I later discovered [unregistered status/forged docs/phishing indicators]. Legal Basis: Articles 315 et seq. (estafa) of the RPC and Sections on computer-related fraud/identity theft under RA 10175; relevant special laws (e.g., Securities Regulation Code/RA 11765) as applicable. Reliefs Sought: Investigation, prosecution, issuance of subpoenas/warrants, preservation requests, coordination with banks/telcos/platforms, and recovery/restitution. Annexes: A—Screenshots; B—Receipts; C—Chat logs; D—Bank statements; E—IDs; F—Timeline; G—Proof of entity status (if any). Verification and Undertaking: I attest to the truth of the foregoing and will present originals when required. Signature/Jurat: Before a notary public or prosecutor (for inquest).

XIII. Demand Letter (Optional, Often Helpful)

Purpose: Put the other party in default, interrupt prescription in some cases, and set a formal record.
Contents: Facts, legal basis, exact sum to pay/return, deadline, and notice of criminal/civil action if unmet.
Delivery: Use a trackable method (courier with proof of service or email with read confirmation).

XIV. Working with Platforms, Banks, and Telcos

Preservation request: Ask them to preserve logs/records relevant to your case; formal production requires lawful process.
Transaction recall: For InstaPay/PESONet or internal transfers, request immediate recall/hold; provide reference numbers and police/NBI complaint details.
Account flagging: Ask institutions to flag subject accounts and report to AMLC as suspicious.

XV. Decision Tree (At a Glance)

Was money solicited as an investment? → SEC + NBI/PNP-ACG (criminal) ± BSP (if banks/e-wallets used)
Was it an unauthorized bank/e-wallet transaction or payment fraud? → Bank/e-wallet (immediate recall), then BSP escalation; NBI/PNP-ACG for criminal aspects
Was personal data harvested/misused (phishing, scraping, doxxing)? → NPC + NBI/PNP-ACG
Is it a lending/financing app or non-bank lender? → SEC + NPC; NBI/PNP-ACG if criminal
Consumer goods/services deception (non-financial)? → DTI + NBI/PNP-ACG if criminal

XVI. Do’s and Don’ts

Act immediately; time is critical for fund holds and data preservation.
Keep all communications in-app (avoid voice calls unless recorded with consent and legality in mind).
Maintain a single, organized dossier for investigators.

Don’t

Pay “release fees,” “taxes,” or “recovery charges.” These are usually part of the scam.
Confront the suspect directly once a formal complaint is underway.
Alter original files or devices.

XVII. Frequently Asked Practical Questions

Can I file with both NBI and PNP-ACG? You may consult either; if both are engaged, disclose the parallel filing so they can coordinate and avoid duplication.
Will I get my money back? Recovery depends on speed, traceability, and whether funds remain in local accounts or platforms that will cooperate. Administrative claims under RA 11765 may offer quicker relief against supervised entities for eligible disputes.
Do I need a lawyer? Not strictly for complaint intake, but legal counsel can sharpen the affidavit, preserve rights, and coordinate multi-agency actions (especially for cross-border and high-value cases).

XVIII. Final Checklist Before You File

✅ Timeline with exact dates/times and amounts
✅ Evidence screenshots/files labeled as Annexes
✅ Reference numbers from banks/e-wallets/platforms
✅ Affidavit-Complaint drafted and notarized (or sworn before prosecutor)
✅ Decision on NBI or PNP-ACG as lead criminal agency
✅ Parallel reports to SEC/BSP/NPC/DTI/IC/CDA as applicable
✅ Contact details where you can be reached quickly by investigators

Staying alert to red flags, preserving evidence correctly, and filing with the right agency fast are the levers that most often change outcomes in scam cases. If in doubt, file—then coordinate.